CVE-2024-56670

Summary

CVE-2024-56670 is a vulnerability affecting the Linux kernel's u_serial driver. In specific scenarios where the driver is accessed by multiple threads, a null pointer issue arises when Thread A attempts to access port->port_usb in the gs_free_requests function, which is set to NULL by Thread B during disconnection. This leads to a crash. To mitigate this issue, developers should add a null pointer check to gs_start_io before accessing port->port_usb. The vulnerability was identified in the call trace of gs_start_io, with potential entry points including tty_open and chrdev_open.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.